I have a customer who wanted to connect 2 locations using a site to site VPN.
I’ve done this many times using Mikrotik.
BUT, at the main location when I unplug their old Linksys EA6350 and plug in my RB2011, ping times go from 10-20ms to hundreds of ms and dropping lots of packets. I’ve tried 3 MT’s with the same result. I plug the Linksys back in and it works again.
I asked the ISP and the have no ideas.
I’ve used MT’s on their fiber many times, but this is old DSL…
Could this be a default firewall rule or something that their DSL doesn’t like?
Any ideas?
(1) Is this a retail linksys router or an ISP supplied router.
(2) What firmware is the linksys running, linksys or third party?
(3) Does the linksys get a public IP from the ADSL modem?
There have been cases discussed on this forum where ISP required certain QoS value in frames received from customer. And if QoS was not set properly, performance would drop under ground.
So by all means, do due inspection of settings on Linksys and see if there’s anything you don’t fully understand. You can come back and ask about anything you find, there are users experienced with Linksys and will be able to comment.
VPNs eat into the path maximum MTU. It’s possible the RouterOS device isn’t negotiating the max MTU on its own for some reason — shortsighted ICMP filtering is a favorite cause — and it would help if it were clamped to the max the path will support without fragmentation.
The problem was solved by turning off auto-negotiate on the WAN port and setting it to 100FDX.
thanks
That voodoo almost never works for me, and when it does, it strongly hints at a broken Ethernet implementation.
What’s the model and brand of the DSL modem?
Were you doing this on the gigabit side of the RB2011? If so, does the symptom continue if you move the cable to take advantage of the RB2011’s dubious feature that half the ports are 100 FDX already? I hope you aren’t burning a gigabit port on this…
If you already had the DSL modem in the 10/100 side, what was it negotiating before you forced it?
The phone line comes into an ISP provided box about the size of a deck of cards which converts it to ethernet. Sorry, I don’t know the brand or model. The next time I’m out there I’ll find out and put it here. I know they’ve been using those boxes for a long, long time.
I thought about moving the WAN port on the rb2011 to a 100Mbs port but I’d spent so much time figuring out why it wasn’t working I left it as-is so I am indeed burning a GB port on this. Who knows if that would have fixed the problem anyway. It makes sense that it would have.
I do know that their DSL is the red-headed stepchild of the local telco. They barely keep it running because they are putting all their effort into fiber.
The flags have been put in the yard so I anticipate that that location will have fiber in a few months so it will be good to have the WAN on a GB port at that time.
The DSL modem is a ZyXEL P-660R-F1
It’s an 11 year old design, and you wonder why it sucks?
turning off auto-negotiate on the WAN port and setting it to 100FDX.
This 100Mb ethernet fixed HDX/FDX can be a real problem, if not matched properly. It happens quite often, with dramatic speed reduction.
HDX/HDX = ok
FDX/FDX = ok
HDX/auto = ok
auto/auto = ok
FDX/auto = problem if fixed FDX does not handle the H/F handshake, so the auto goes to HDX.
And in this FDX/HDX combination there are many collisions caused by the FDX sending regardless the other direction traffic.
Reason for the problem is when fixed FDX is not answering on the auto’s negotiation, then the auto assumes the other end is an old HDX implementation, resulting in “Duplex mismatch”